Second slice of B (hybrid coverage): the controls violated by an *absence*
(no rate limiting, no security logging, no update-signature check) have no
syntactic pattern for semgrep, so we retrieve the code surface each governs and
let the grounded judge decide whether the control holds.
- controls/surface.rs: deterministic, bounded surface retrieval (keyword +
window, capped per control) for cra-ai-6,11,24,27,28,29,30.
- grounded_surface_findings(): retrieve surfaces -> GroundedControlChecker ->
net-new findings, each already tagged with its control and grounded to a real
snippet (ground() drops anything not quoting verbatim code).
- orchestrator Stage 5d, gated on breakpilot.grounded_control_checks
(BREAKPILOT_GROUNDED_CHECKS, default off) — absence detection is the least
deterministic path, kept off until tuned against live scans.
- LUT: the 7 controls' notes now point to the gated grounded mechanism (kept
needs_tooling; coverage stays honest until live-validated).
Local validation (real Qwen, temp 0), correct positive+negative discrimination:
cra-ai-11 unprotected login -> violates, CWE-307, grounded; protected -> false
cra-ai-24 unlogged admin del -> violates, CWE-778, grounded; logged -> false
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Each deploy job now builds the per-service image, pushes to the
private registry as :latest and :sha, then triggers an HMAC-signed
orca redeploy webhook. Coolify webhooks are no longer used.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
